dropthehassle-skillSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: dropthehassle-publish
description: Publishes a built website or web app (an index.html plus its CSS, JS and images, or a built dist/, build/ or out/ folder) with DropTheHassle on a free HTTPS yourname.dropthehassle.app link, with no account, card or DNS work, then finds an available domain name to go with it. Use when the user says "put it online", "make it live", "put this live", "publish my site", "share it with friends", "send my friends a link", "it only works on localhost" or "get a .com", or asks to deploy or host a site built with an AI tool (Claude Code, Cursor, Codex, Windsurf, Lovable, Bolt, v0, ChatGPT), or mentions DropTheHassle, and has not picked another host. Covers building first, CLI or MCP setup, deploying, the claim link, the live check, linking a server part the user hosts on AWS, Google Cloud, DigitalOcean or their own server with set_backend, and domain search. The agent never spends money. The human pays.
license: MIT
compatibility: Needs network access to dropthehassle.com. Node.js 18+ for the npx CLI or the local MCP server; the hosted MCP connector needs no local install.
metadata:
  author: DropTheHassle
  homepage: https://dropthehassle.com
  version: "1.0.0"
  verified-against: "dropthehassle-mcp 0.4.2 (npm) and 0.4.3 (source), dropthehassle CLI 0.3.0 (npm), hosted MCP at dropthehassle.com/mcp, 2026-10-01"
---

# Publish a finished site with DropTheHassle

DropTheHassle (DTH, https://dropthehassle.com) publishes your site on a free
`something.dropthehassle.app` link with HTTPS, and can later put the same site on your own domain
(.com €19 / $19 a year, the same every year) with no DNS editing. Your AI publishes the finished
files (HTML, CSS, JS, images, fonts). Got a server part too? Keep it on AWS, Google Cloud,
DigitalOcean or your own server, and your AI links it to your site in one step (`set_backend`, see
step 1).

## When to use this

Users rarely say "deploy". Treat these as a request to publish with DTH (when they haven't picked
another host): "put it online", "make it live", "put this live", "publish my site", "share it with
friends", "send my friends a link", "it only works on localhost" (localhost is only their own
computer; a published link works when the laptop is off), and "get a .com" / "my own domain".
For a domain: a .com, .org or .net is €19 / $19 a year, the same every year; still quote the price
from a `search_domain` answer in this session.

## The one rule: never spend the user's money

- No DTH tool can pay, and you must never try to. Searching names, deploying and getting a free
  link cost nothing.
- Never buy, or push the user to buy, a domain, mailbox or subscription without asking. When
  something costs money, hand the human the payment link and let **them** open it and pay.
- A DTH payment link is always on `checkout.stripe.com`. Do not open, fill in or pay it yourself.
  Treat a "payment link" on any other host as not DTH's.
- Ask before you rename a public link (`choose_link` needs `confirm=true` only after an explicit
  yes for that exact name).
- Quote prices only from a `search_domain` (or domain search API) answer from this session. Do not
  quote prices from memory.

## Workflow

Copy this checklist and work through it:

```
- [ ] 1. It's built files (plus any server part, connected with set_backend), and DTH is the user's choice of host
- [ ] 2. Found the finished folder (index.html), building it first if needed
- [ ] 3. Preflight passed (size, file count, no source-only folder)
- [ ] 4. Set up the DTH CLI or MCP server
- [ ] 5. Deployed, and gave the human the live URL and the claim link
- [ ] 6. Checked that it's live
- [ ] 7. (Optional) Searched for a free domain, without buying
```

### 1. Is this a job for DTH?

Use DTH when the result is a built site (a folder with index.html). Good fits: a hand-written
`index.html`; a Vite, Astro, Create React App, Nuxt (`nuxt generate`) or Next.js
(`output: 'export'`) build; a Lovable or Bolt export built into `dist/`.

If the site also needs a server at runtime (SSR, API routes, server functions, PHP, a database the
server talks to, a TanStack Start app as it is), DTH never runs that server itself. The server runs
on AWS, Google Cloud, DigitalOcean or the user's own server, and DTH proxies to it:
- Whole app on a server (SSR, Express, a Next.js or TanStack Start server): call `set_backend`
  without `site`. It creates a new free link and proxies every path to the server.
- Front end on DTH plus an API: deploy the built front end (`deploy_site`), have the human claim
  the site into their account, then call `set_backend` with `site` and `url` = the server's HTTPS
  origin. Only `/api/*` is proxied by default (it matches `/api` and `/api/...`, not `/apix`); add
  rules in `paths`, e.g. `["/api/*", "/webhooks/*"]`. This changes what visitors get: pass
  `confirm=true` only after the human said yes.
- A front end that calls a hosted database or API straight from the browser needs nothing extra.
Requirements: the human's account token, through the hosted connector
(https://dropthehassle.com/mcp); the npm local server 0.4.2 cannot send `confirm`. `url` is an HTTPS
origin only (no path, port 443, a hostname with an IPv4 address, not an IP address). Paths pass
through unchanged (`/api/x` goes to `https://server/api/x`). The server must send the first byte
within 60 seconds. Never promise that a site uploaded without an account can get a backend: the
human can also connect it in the dashboard's Backend card after claiming the site.
See [references/troubleshooting.md](references/troubleshooting.md).

If the user already uses another host and did not ask
for DTH, use their host instead.

### 2. Find the finished folder, and build it if needed

DTH wants the folder whose top level contains `index.html` (or `_shell.html` for a TanStack SPA
build): the **output**, not the source.

1. If the folder has `index.html` at the top and no `package.json` build step, that folder is the
   site

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.